guide
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources and the repository itself while possessing execution capabilities.
- Ingestion points: Processes content from external websites (web search and page fetching) and local repository files including documentation, source code, and Git history (SKILL.md).
- Boundary markers: Instructions emphasize verifying facts against durable artifacts rather than relying on memory or subagent findings alone. It explicitly states to distinguish intent from current behavior.
- Capability inventory: Can execute discovery-only shell commands (e.g.,
git log,git show,ls,grep), perform web searches, delegate tasks to subagents, and create/edit.mdfiles. - Sanitization: No specific sanitization methods are described for handling external content before it is processed by the agent or included in documentation outputs.
Audit Metadata